in the forum post http://kb.monitorware.com/viewtopic.php?p=24957 we have a user
who has a product that is limited by license to a daily average of 250 logs/sec
(21.6M logs/day), beyond that, the appliance drops logs and reports "daily limit
exceeded" instead of reporting on that day's log. But they don't hit this limit
every day.
What they are looking to do is to keep the feed below that limit. Their initial
attempt was to configure a delay after delivering each message. I just realized
that the reason it may not seem to be working is that that delay is per batch of
messages, so it will let 250*batchsize messages/sec through
But this is a very poor approach to take, even if it can be made to work.
I was thinking about what else could be done and I had a thought occur to me.
Would it be possible to use global variables for this?
Have a global variable to hold the currentday, and another to hold messagecount.
if messagecount < limit, incriment messagecount and deliver the message
else block output and let messages queue
if currentday < actual day, reset messagecount, unblock queue
I know the tracking could be done, but is there a reasonable way to block an
output so that the message will queue up until it's unblocked?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
